lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Tue, 27 Oct 2009 16:42:07 -0400
From:	David Safford <>
To:	Eric Paris <>
Cc:	Eric Paris <>,
	Mimi Zohar <>,, James Morris <>,
	Rajiv Andrade <>,
	Jean-Christophe Dubois <>,
	Mimi Zohar <>,
	Stable Kernel <>
Subject: Re: [PATCH] ima: remove ACPI dependency

On Tue, 2009-10-27 at 12:36 -0400, Eric Paris wrote:
> On Tue, 2009-10-27 at 11:59 -0400, David Safford wrote:
> > Basically, if running on a system with a TPM, IMA wants the TPM
> > boot measurement log, which the TPM driver can only get through
> > ACPI. If the platform does not have a TPM, then IMA does not 
> > need ACPI.
> I'm afraid I'm not seeing the connection.  Where does IMA gets the boot
> measurement log?  I see that the TPM exports that log in securityfs as 2
> files (ascii and binary) in tpm_bios.c but I don't see how IMA ever
> makes use of that log either internally to the kernel or through the
> securityfs files.
sorry - bad explanation. IMA reads PCR 0-7, and combines them into
a single "boot_aggregate" as the first entry in the IMA list. For full
attestation, a user level program needs access to both IMA's
boot aggregate, and to the detailed TPM event log upon which
the aggregate is based. So IMA does not itself access the logs,
but the boot aggregate is less useful without them.

As a separate issue, IMA requires the TPM driver to be compiled in
(not loaded as a module) so it is available at IMA initialization, and
the driver apparently requires ACPI in this case. I believe Rajiv
will comment more on this.


> If I'm missing it, and IMA is getting and making use of the bios boot
> log I think we need to instead make the TPM code send a reasonable
> failure code without ACPI and IMA should be changed to handle it.  I
> really don't like the obscure ACPI requirement.

> -Eric

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists